full-disclosure - Super Worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200404192235.i3JMZpFG028620@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Super Worm 

On Mon, 19 Apr 2004 16:01:49 CDT, Bart.Lansing@...ls.com  said:

> "...without those dimwits..." "...stupidity of end users..."
> 
> sheesh....ok...show of hands please; how many of us systems wizards can do 
> the jobs the "dimwits" are doing?  You infosec guys at hospitals...do any 
> heart transplants lately?  Infosec guy at investment bank...you structure 
> any billion dollar mergers last week?  No?  Well what not??  Are you some 
> kind of dimwit?? Are you stupid???

No, I don't pretend to know how to do a heart transplant, or understand all the
details of what my researchers are doing.  They explain what computer resources
they need to get their work done, and it's *my* job to talk to them, in
language they can understand, and figure out what they need:

"I need e-mail - with pictures.."
"How big a picture?"
"They're x-rays of horse joints"
"Can you show me an example?"

<poke around on disk, find how many megabytes one is, and how many a day they
need, and now long to retain them, and stuff like that - things that *they*
know the answer to - 25/day, need to keep for a year>

And in a perfect world, I return with a complete solution - hardware, software,
training, and support.  In the real world, I come back with as much of it as I
can swing out of the resources available.

However, your analogy breaks down here:

I have enough sense to know the limits of my knowledge and stay away from
scalpels.  It's the heart surgeons that put down scalpels and start fooling
around with that Administrator account that tick me off.

And given that I'd get arrested the 3rd time I tried to perform surgery,
I think I'm morally justified if I get ticked the 3rd time that surgeon
practices sysadminning without a license. ;)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040419/09cf2a04/attachment.bin